gcleaner | aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad

Analysis

max time kernel
142s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
Size

399KB
MD5

1176eddcbf25be2d6f06c21b3b40b755
SHA1

23188a80c906942d357f8bb2660e9061e933786d
SHA256

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad
SHA512

eec48e24cd338731b8f5f5e1aebbf33ec3df8ff47db4994e4781580a9fc7462b70de7948b1c81876d6a34ab4f56cb3821a3784afde2a3005eef30f548b501ee3
SSDEEP

6144:DqLTSRU7j5Byw9oF0VYz5cti3LuQMTIWt:2/yU7j5bgNz2i3KQMT

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3832	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4568	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4480	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
2900	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4040	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
1088	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
1504	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4984	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
4512	1028	WerFault.exe	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

pid process

1028 aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

pid	process
1028	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

C:\Users\Admin\AppData\Local\Temp\aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
"C:\Users\Admin\AppData\Local\Temp\aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 424
2⤵
- Program crash
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 772
2⤵
- Program crash
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 812
2⤵
- Program crash
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 832
2⤵
- Program crash
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 872
2⤵
- Program crash
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 928
2⤵
- Program crash
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 936
2⤵
- Program crash
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 1148
2⤵
- Program crash
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 776
2⤵
- Program crash
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1028 -ip 1028
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1028 -ip 1028
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1028 -ip 1028
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1028 -ip 1028
1⤵
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1028 -ip 1028
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1028 -ip 1028
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1028 -ip 1028
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1028 -ip 1028
1⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1028 -ip 1028
1⤵
PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-1-0x0000000002620000-0x0000000002720000-memory.dmp

Filesize
1024KB

Download
memory/1028-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1028-2-0x0000000003FC0000-0x0000000003FFC000-memory.dmp

Filesize
240KB

Download
memory/1028-4-0x0000000000400000-0x0000000002380000-memory.dmp

Filesize
31.5MB

Download
memory/1028-5-0x0000000002620000-0x0000000002720000-memory.dmp

Filesize
1024KB

Download
memory/1028-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download